Privacy Policy

Chit ("we", "us") is operated by M Tech, contactable at support@chit.website. This policy explains what personal data we handle through the Chit app, why, and what rights you have over it.

1. Three kinds of personal data Chit handles

Chit is a tool one business (yours) uses to invoice — and now collect payment from — another set of people (your clients), so there are three different relationships this policy needs to cover:

• Your account data.When you sign up, we're the data controller — we decide why and how it's processed, and this policy is our promise to you about that.
• Your clients' contact data.The names, addresses, phone numbers, and notes you store about your own clients belong to your business, not ours — you are the data controller for that information, and we're simply the processor storing it on your behalf, on your instructions. If one of your clients asks you what data you hold on them, that request is yours to answer, not ours.
• Your clients' payment data, if they pay an invoice online.When a client uses the "Pay online" link on an invoice, their card details and payment information are handled directly by Stripe — we never see or store them. See section 6.

2. What we collect about you

• Your email address and password (handled securely by our authentication provider, Supabase — we never see your password in plain text).
• Your business name, address, and VAT details, if you choose to add them.
• Your bank details (sort code, account number, account name) and any other payment notes you choose to add to your invoices, if you use that feature. These are stored so they can be printed on your own invoices — we don't use them for anything else.
• Subscription billing information — handled entirely by Stripe. We never see or store your card details.
• If you set up online payments, a connected Stripe account in your name — see section 6.
• Basic technical data (like log-in timestamps and general usage patterns) needed to keep the service running securely — see section 10 on analytics.

3. What you store about your clients

Client names, addresses, phone numbers, and any notes you add are stored so you can generate invoices. We don't use this data for anything beyond providing the service to you, and we don't sell or share it.

4. Emailing invoices, and receiving replies

If you use Chit to email an invoice, the recipient's email address and the invoice itself are passed to our email provider, Resend, to deliver it. If your client replies to that email, Chit automatically receives that reply, reads it briefly to work out which invoice it relates to, and forwards it on to you with the invoice re-attached — the content of that reply passes through our systems for a moment in order to do that, but we don't read, store, or use it for anything beyond forwarding it to you.

5. Why we process this data

On the basis of our contract with you (providing the invoicing and payment service you've signed up for), and, for the technical/security data, our legitimate interest in keeping Chit working and secure.

6. Online payments (Stripe Connect)

If you choose to set up online payments, we use Stripe Connect to do it. This means:

• Stripe collects and verifies your own identity and business details directly — we never see the full details you give Stripe as part of that setup, only whether it's been completed.
• When a client pays an invoice online, their card details are entered directly into Stripe's own payment page and never pass through our servers or database.
• Payments go straight to your own connected Stripe account and, from there, your own bank account — we never hold or have access to this money.
• We're told when a payment succeeds (so we can mark the invoice paid automatically), but not your client's full card details.

7. Who else sees your data

We use a small number of specialist providers to run Chit — we don't sell data to anyone, and these providers can't use your data for their own purposes:

• Supabase — hosts our database, file storage, and handles account log-in.
• Stripe — processes your subscription payments, and (if you set it up) your clients' invoice payments via Stripe Connect.
• Resend — sends emails on your behalf (invoices, password resets) and receives client replies to forward them to you.
• [Your hosting provider, e.g. Vercel] — hosts the application itself, and provides basic, privacy-friendly visitor analytics (see section 10).

8. Where your data is processed

Some of the providers above may process or store data outside the UK, including in the United States — this is normal for most software services and doesn't mean your data is less protected. Where that happens, it's covered by legally recognised safeguards (such as Standard Contractual Clauses or an equivalent adequacy arrangement) that each provider maintains as part of their own compliance. Their current data processing terms and locations are published on their own websites, since these details can change over time.

9. Support and account access

A small number of people responsible for running Chit can access account data — for example, to help you if something's gone wrong, to investigate suspected abuse or fraud, or to manually grant or fix account access when you ask us to. This access isn't used to look at your data otherwise, and is limited to what's needed to help or keep the service safe.

10. Cookies and analytics

We use strictly necessary cookies to keep you logged in securely. We also use privacy-friendly, cookieless visitor analytics (via Vercel Analytics) to understand overall traffic to the site — this doesn't track you individually across other websites or build an advertising profile, and we don't use advertising or tracking cookies.

11. How long we keep it

We keep your data for as long as your account is active. If you delete your account, we delete your business and client data within 30 days, except where we're required to keep billing records for tax purposes for longer.

12. Your rights

Under UK data protection law, you can ask us to:

• Give you a copy of the data we hold about you
• Correct anything inaccurate
• Delete your account and associated data
• Export your data in a portable format
• Object to or restrict certain processing

To exercise any of these, email support@chit.website. You can also complain to the UK Information Commissioner's Office (ico.org.uk) if you think we've got something wrong.

13. Changes to this policy

If we make significant changes, we'll let you know by email or an in-app notice before they take effect.